PRIVACY POLICY

Effective date: 23.06.2026
Last updated: 23.06.2026

1) Who we are and how to contact us

The personal data controller (Art. 4(7) of the General Data Protection Regulation /GDPR/) is
“FERRYONE” OOD, UIC 208212295, with registered office and address of management:
Sofia, Izgrev District, 13B “Tintyava” St., apt. ground floor.

The company is registered as a travel agent in the Register of Tour Operators and Travel Agents, part of the National Tourism Register of the Republic of Bulgaria – Registration Certificate No. RK-01-8584, issued on 30.05.2025.

This Policy applies to our website, mobile applications and related online services (the “Platform”).

2) What we process, why, and on what legal basis

We process only the data necessary for specific and lawful purposes, including search, booking, payment, ticket/travel document issuance and delivery, customer support, changes, cancellations, refunds, complaints, security, accounting, legal obligations and improvement of the Platform.

Legal bases: contract or steps before entering into a contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), legal obligation (Art. 6(1)(c) GDPR).

Roles under the GDPR: FERRYONE processes personal data as a controller for its own services, including the Platform, accounts, booking flow, support, payments, security, accounting and communications. Depending on the specific service, ferry operators, carriers, booking systems, technical/API/GDS providers, distribution partners, insurance partners, payment providers and other providers may act as independent controllers, joint controllers or processors under the relevant contractual and legal framework.

2.1. Visiting the site/apps (logs and security)

  • Data: IP address, date/time, URL/referrer, session identifier, device/browser identifier, OS, language, basic device information, approximate technical location, access logs, errors, crash/diagnostic data, cookie consent status and other technical data necessary for operation and security.
  • Purposes: content delivery, normal operation of the Platform, protection against abuse/fraud, prevention of unauthorized access, diagnostics, load, performance, monitoring of technical incidents and evidence of actions in case of dispute.
  • Basis: legitimate interest (security, continuity, abuse prevention and technical support); legal obligation where required by law.
  • Retention: up to 90 days for standard server logs; in case of incident, dispute, abuse or legal requirement – until the investigation, dispute or respective legal obligation is completed.
  • Recipients: hosting/cloud providers, logging/monitoring providers, security tools, technical support and competent authorities, where applicable.

2.2. Registration/sign in and account (incl. social login)

How you sign in: sign in via Google, Facebook or Apple (without separate email/password registration), where such functionality is available. Under the sign in buttons we display links to the “Terms of Use” and the “Privacy Policy.” By default, only strictly necessary technologies are loaded (see § 3).

What data we receive from the IdP: name, email (with “Hide My Email” possible when using Sign in with Apple), your unique identifier with the respective IdP, technical markers for sign in, security and session. We never receive your password and do not post on your behalf.

Account details and Booking contact details: Your account data (“Account details”) is separate from the contact data for a specific Booking (“Booking contact details”). Changes to your account do not automatically change already made Bookings, because each Booking keeps its own snapshot of the data submitted at purchase.

Additional data (optional/where available): phone for operational contact, preferred contact channel, saved contacts, passengers, vehicles or other reusable templates for future Bookings. Such data is used for convenience and does not automatically change past Bookings.

  • Purposes: create and maintain an account, sign in, link Bookings to account, access My bookings, security, customer support, autofill for future Bookings where available.
  • Basis:
    • Art. 6(1)(b) GDPR (sign in, account, servicing Bookings);
    • Art. 6(1)(f) GDPR (security, abuse prevention, technical continuity);
    • Art. 6(1)(a) GDPR (consent-based features – e.g., marketing push, marketing personalization, optional saved templates where applicable).
  • Retention: account data – until account deletion; saved templates/contacts/passengers/vehicles – while you keep them in the account or until deletion; session tokens and access logs – up to 90 days; backups – up to 30 days after deletion, unless a longer period is required by law or dispute.
  • Recipients: Google, Meta (Facebook) and Apple are independent controllers for your accounts with them; we use the data received only for the purposes above.

2.3. Bookings and payments

  • Data: names, contacts, booking contact details, booking code, operator/system reference, route, date, time, departure/arrival port, booking status, ticket status, price, fees, FERRYONE service fee, additional services, refund/change/cancellation status, booking communications and invoicing/accounting data.

  • Passenger data: first and last name as shown in the document, date of birth, age category, citizenship/nationality, gender, document type, document number, document validity, country/place of birth and other data where required by the ferry operator, booking system, law or port/border authorities.

  • Vehicle data: type/category, make, model, registration number, dimensions, height, length, trailer, roof box, bike rack, external equipment, fuel or other characteristics where necessary for the Booking.

  • Pet data: type/count/category and other data where required according to the operator’s, route’s or vessel’s rules.

  • Special assistance data: where you expressly provide information about special assistance, reduced mobility, wheelchair, medical equipment, companion or other sensitive information, we process it only to the extent necessary to pass the request to the relevant operator/Supplier and organize assistance. We do not request medical diagnoses unless necessary and legally permitted. Where such information constitutes special category data under Art. 9 GDPR, we process it based on your express provision/consent and/or another applicable basis permitted by law.

  • Payment data: we do not store full bank card data and we do not store CVV/CVC codes.

  • Purposes: search for availability and prices; create, confirm and manage a Booking; payment; issuance and delivery of a ticket, e-ticket, PTA, voucher, booking reference or other travel document; performance of travel; booking communication; changes, cancellations and refunds; special assistance; complaints; customer support; accounting; claims defense and evidence of performance.

  • Basis: contract or steps before entering into a contract; legal obligation (accounting, taxes, lawful requests); legitimate interest (evidence of performance, claims defense, abuse prevention); consent or express provision by you where special assistance information or optional saved templates are processed.

  • VPOS (payments): card payments are processed via a virtual POS (VPOS) provided by DSK Bank AD. Card details are entered directly in the bank’s secure payment environment and are not stored by FERRYONE. Transactions are carried out through the security programs MasterCard Identity Check and Visa Secure, as well as other applicable strong customer authentication measures. We receive limited information such as payment status, transaction identifier, amount, date/time, payment attempt status and other technical information necessary for processing, evidence and accounting of the payment.

  • Refunds: if a refund is required for an amount paid by card, it is refunded to the same card, unless applicable law or the payment process requires otherwise. We may process refund status, refund amount, reason, date, payment reference and communications with the payment provider, operator or booking system.

  • Retention: booking data – up to 5 years (for claims defense and operational history); accounting records – up to 10 years; communications regarding a specific Booking – up to 24 months after completion, unless needed to protect rights, handle a complaint, dispute or legal obligation.

  • Recipients: ferry operators/carriers; booking systems; technical/API/GDS providers; distribution partners; payment providers, including DSK Bank AD; insurance partners or providers of additional services if you have selected such a service; hosting/email/support providers; accountants, legal advisers and competent authorities where necessary.

2.4. Support, communications, complaints and claims

  • Data: names, email/phone, booking code/reference, ticket number, passenger name, travel date, inquiry content, complaint description, attachments, photos/documents, chat/ticket records, communication history, source page and technical data related to the request.
  • Purposes: customer support, responses to inquiries, assistance with changes, cancellations, refunds, special assistance, complaints, passenger rights, communication with operator/booking system/Supplier, evidence of actions performed and protection of rights.
  • Basis: contractual actions; legitimate interest (support, evidence of performance, claims defense); legal obligation where applicable.
  • Retention: up to 24 months from the last correspondence; in case of dispute, complaint, chargeback, claim or legal obligation – until completion and expiry of applicable limitation periods.
  • Recipients: the relevant ferry operator/carrier, booking system, technical/API/GDS provider, insurance partner, payment provider or other Supplier where necessary to handle the case. The relevant operator or Supplier may contact the customer or contact person directly regarding travel-related information, including changes, delays, cancellations, boarding instructions, passenger rights, safety notices or other operational messages.

2.5. Marketing, personalization and statistics

  • Analytics/diagnostics (server logs): aggregated events and logs for stability, performance and improvements without accessing the device – legitimate interest; retention up to 14 months, unless a shorter or longer period is required for security/incident reasons.
  • Analytics/SDK/cookies: when measurement requires storing or accessing information on the end-user device (cookies, SDK, IDFA, AAID or similar technologies), we enable it only after consent.
  • Advertising and measurement (Meta/Google and others): advertising pixels, conversion tracking, remarketing, audience tools and advertising measurement are enabled only after consent in “Cookie Settings” or the applicable consent flow. Without consent we do not load advertising tags/pixels/SDKs and do not use advertising identifiers for these purposes.
  • Email newsletter/marketing messages: sent with express sign up (consent) or under permissible soft opt-in to our own customers for similar services where the law allows this and we provide an opt-out at collection and in every message.
  • Retention: marketing profiles/identifiers – up to 12 months or until consent is withdrawn; marketing consent/withdrawal logs – as long as necessary to evidence the choice and comply with the law.

2.6. Third party data (co travelers, passengers, children, contact persons)

If you provide personal data of third parties (e.g., co travelers, children, other passengers, contact persons or owners/users of a vehicle), you confirm that you are authorized to do so and, where applicable, that you have informed them about this Policy.

Where we have their contacts and this is necessary or required by law, we may provide them with the information under Art. 14 GDPR within the time limits set by law. In some cases this may be done through you as the person who provided the data and organizes the Booking.

3) Cookies and similar technologies

We use cookies, local storage, session storage, SDKs, pixels and similar technologies. Detailed information is available in the Cookies Policy.

Main categories:

  1. Strictly necessary – required for security, navigation, language preferences, session, sign in, booking flow, checkout, payment flow, cookie consent storage and the basic operation of the Platform. They are always active and cannot be disabled through the cookie banner.
  2. Analytics – help us understand how the Platform is used and improve the website and booking experience. They are loaded only after consent.
  3. Advertising and measurement – used for Google Ads conversion tracking, Meta Pixel, remarketing, advertising performance measurement and similar purposes. They are loaded only after consent.

Your control:

  • Web: “Cookie Settings” menu with buttons “Accept all” / “Reject optional” / “Customize.”
  • Apps: control through OS settings (App Tracking Transparency / Advertising ID), as well as through the “Privacy” menu, if available.

Retention:

  • Strictly necessary – session or up to 12 months;
  • Analytics – up to 14 months;
  • Advertising and measurement – according to the provider, typically 6–12 months;
  • Cookie consent logs – up to 12 months or until the next material change/new consent version.

We maintain an up-to-date Cookie List on the website where applicable.

4) Mobile apps and store requirements

  • iOS (Apple): we use IDFA only with consent under App Tracking Transparency where applicable.
  • Android (Google Play): we use the Advertising ID only with consent for marketing/advertising measurement where applicable; you can reset/limit it from OS settings.
  • Sign in with Apple: the protected email (“Hide My Email”) is used only for your account, Bookings, tickets, support and related communications.
  • Data Safety/Privacy Labels: store disclosures should reflect the data actually collected and your choices.

5) Recipients and categories of providers

We may share personal data only where necessary for the purposes under this Policy and subject to appropriate contractual/legal safeguards:

  • Ferry operators/carriers: for search, booking, ticket issuance/change, travel performance, boarding, special assistance, complaints, passenger rights, changes, cancellations and refunds.
  • Booking systems, technical/API/GDS providers and distribution partners: for access to schedules, prices, availability, fare rules, booking creation, ticket issuance, PTA/e-ticket/voucher, changes, cancellations, refunds and back-office processes.
  • Payment services: DSK Bank AD (VPOS; card payment processing and security measures, including SCA/3D Secure where applicable).
  • Insurance partners and providers of additional services: where you select insurance, an add-on, support service, notification service or another additional service.
  • Hosting/logs/monitoring: AWS or other cloud/infrastructure providers (mainly EU regions).
  • Sign in, communication and productivity services: Google, Meta/Facebook, Apple, email delivery, support/admin tools, if used for the respective functionality.
  • Advertising/measurement: Meta Platforms, Google and other advertising/measurement providers – only with consent where required.
  • Advisers and authorities: accountants, legal advisers, auditors, banks, payment institutions, public and supervisory authorities where necessary or required by law.

Joint and independent controllers:

  • Ferry operators, carriers, payment providers, insurers, Google, Meta, Apple and other providers may act as independent controllers for their own purposes where they determine the purposes and means of processing.
  • Meta Business Tools and Google Ads/Conversions may involve joint or independent controller regimes according to the applicable terms. These technologies are enabled only with consent where required.
  • Technical/API/GDS providers, hosting, support and email providers may act as processors on our behalf where they process data only on our instructions.

6) Where we process and transfers outside the EEA

Data is stored and processed mainly in the EU/EEA, including through cloud providers in EU regions where applicable.

Where transfer outside the EU/EEA is necessary (e.g., to Google, Meta, Apple, technical/API/GDS providers, support tools or other partners), we apply appropriate mechanisms under the GDPR, including adequacy decisions, Standard Contractual Clauses (SCC), mechanisms under the EU–US Data Privacy Framework for certified recipients, additional security measures, minimization, encryption and restricted access.

7) Maximum retention periods

  • Server logs/security: up to 90 days; in case of incident, abuse or dispute – until completion/requirement.
  • Cookie consent logs: up to 12 months or until a new version/material change of the consent choice.
  • Analytics (aggregated/anonymized): up to 14 months, unless provider settings or law require another period.
  • Account/settings: until account deletion + up to 30 days in backups.
  • Saved contacts/passengers/vehicles/templates: while you keep them in the account or until deletion.
  • Communications and support: up to 24 months from the last correspondence.
  • Complaints/disputes/chargebacks: until completion of the case and expiry of applicable limitation periods.
  • Marketing profiles/identifiers: up to 12 months or until consent is withdrawn.
  • Bookings, tickets, booking history, change/cancellation/refund history: up to 5 years (for claims defense and operational history).
  • Payment references and payment/refund logs: up to 5 years or longer if part of accounting records, dispute or legal obligation.
  • Accounting and tax documents: up to 10 years.

If required by law, dispute, audit, inspection or protection of rights – we may keep data longer only to the extent necessary.

8) Security of processing

We apply technical and organizational measures, including:

  • TLS encryption in transit;
  • encryption of data at rest in cloud infrastructure where applicable;
  • segmentation in AWS VPC or equivalent infrastructure;
  • key/secret rotation;
  • access control (least privilege);
  • multi-factor authentication for administrative access where applicable;
  • monitoring, alerts, logging and tests;
  • access limited only to persons with a business need and confidentiality obligation.

We do not store full bank card data and we do not store CVV/CVC codes. Card data is entered in the secure payment environment of the payment provider.

Incidents: in case of a personal data security breach, we will notify the CPDP and affected individuals where required by Art. 33 and 34 GDPR, and we will assist in mitigating the risk.

9) Minors

The Platform is intended for persons aged 18+. We do not create user accounts for children.

Data about children/minors may be provided only by a parent, guardian, custodian or another authorized adult in connection with a specific Booking and is processed to the extent necessary for search, booking, ticket issuance, travel performance, special assistance, legal obligations or operator/carrier requirements.

We do not use children’s data for marketing. If you suspect unauthorized submission – write to privacy@ferryone.com.

10) Automated decisions and profiling

We do not make decisions solely on the basis of automated processing that produce legal or similarly significant effects for you within the meaning of Art. 22 GDPR.

Profiling may be used only for marketing personalization, advertising and measurement and only with consent where required.

Prices, availability, fare rules, confirmations, changes, cancellations and refunds may be determined by external operators, booking systems, API/GDS providers or payment providers according to their rules and system processes. FERRYONE does not make an independent automated decision with legal or similarly significant effect based solely on such data.

11) Your rights

You have the following rights under the conditions and limitations of the GDPR and applicable law:

  • right of access;
  • right to rectification;
  • right to erasure;
  • right to restriction of processing;
  • right to portability;
  • right to object;
  • right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
  • right to receive information about recipients to whom data has been disclosed where applicable.

How to exercise: write to privacy@ferryone.com.
We may require reasonable identity verification. We respond within 1 month, which may be extended by up to 2 months in case of complexity or a large number of requests, of which we will notify you.

Please note that some rights may be limited where data is necessary for performance of a Booking, ticket issuance, accounting, legal obligation, claims defense, security logs, fraud prevention or where data has already been transferred to an independent controller such as a ferry operator, payment provider or insurer. In such cases we may also direct you to the relevant independent controller.

Right to lodge a complaint:
Commission for Personal Data Protection (CPDP)
Sofia 1592, 2 “Prof. Tsvetan Lazarov” Blvd.
www.cpdp.bg • kzld@cpdp.bg

12) Updates to the Policy

We may update this Policy due to changes in the Platform, services, operator model, providers, technologies, legal requirements or internal processes.

We will always indicate the “Last updated” date. For material changes, we will notify you in an appropriate manner, for example via banner, notice in the Platform or email where applicable.

13) Privacy contacts

Controller: “FERRYONE” OOD, UIC 208212295
Address: Sofia, Izgrev District, 13B “Tintyava” St., apt. ground floor
Email: privacy@ferryone.com
Support: support@ferryone.com

This Policy is adopted by “FERRYONE” OOD and enters into force as of the “Last updated” date stated above.

END